REvil Ransomware: Kaseya VSA Supply Chain Attack

This Cyble report dissects the July 2021 REvil (Sodinokibi) supply-chain ransomware attack that abused Kaseya VSA to distribute a signed dropper which side-loaded a malicious mpsvc.dll via MsMpEng.exe, enabling widespread encryption across MSPs and their clients; it includes technical analysis (dropper behavior, RC4-encrypted JSON configuration, registry artifacts, firewall and Defender disablement), multiple IoCs (SHA-256 hashes and a Tor C2 URL), observed victim counts and industry distribution, and actionable remediation recommendations.